Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

tier2_capture.go: classified apps get TierSecondary per-bind legs (paperless copy shrinks — export
drops); legacy apps keep the byte-identical resolver set. v2 relpath-mirroring layout
(backups/secondary/<stack>/{marker LAST, recovery-unit/, hdd/<rel>/, userdata/<rel>/}); N>1 native
(errTier2MultiDir/tier2AppDataName deleted). Migration=delete-and-rebuild + reconcile; all RemoveAll
via tier2SafeRemove (refuses outside backups/secondary/). SSD=state-only tier. selectTier2Target
never picks network storage (pinned+auto, F-6C-1). Restore reads v2 behind a marker gate.
Part 0: offbox_enlarge_blocked is a persisted one-time Load seed (opt-out sticks), not a getter
append. Part 0.5: offsite restore scratch prefers a local (non-network) path.
Full v2 test suite + all 10 §10 red-proofs verified. Destructive writes bounded to backups/secondary/.

controller/internal/web/async_restore_test.go

@@ -69,8 +69,12 @@ func newAsyncRestoreServer(t *testing.T) (*Server, *blockProvider, *backup.Manag
 	}); err != nil {
 		t.Fatal(err)
 	}
-	// a recorded Tier-2 copy dir so RestoreTier2Files proceeds to StopStack (where we block).
-	if err := os.MkdirAll(filepath.Join(dest, "backups", "secondary", "app", "appdata"), 0o755); err != nil {
+	// a recorded v2 Tier-2 copy (marker + an hdd/ leg) so RestoreTier2Files proceeds to StopStack.
+	destBase := filepath.Join(dest, "backups", "secondary", "app")
+	if err := os.MkdirAll(filepath.Join(destBase, "hdd", "appdata"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(destBase, ".felhom-tier2-layout"), []byte("2"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	cfg := &config.Config{}

controller/internal/web/handlers.go

@@ -844,6 +844,7 @@ type AppBackupRow struct {
 	Tier2LastRun     string
 	Tier2LastStatus  string // "ok", "error", "running", ""
 	Tier2LastError   string
+	Tier2LastWarning string // 3b: capture-gap / state-only notice on an otherwise-ok run
 	Tier2StatusBadge string // "Sikeres", "Hiba", "Fut...", "—"
 	Tier2SizeHuman   string
 
@@ -996,6 +997,7 @@ func (s *Server) buildAppBackupRows(status *backup.FullBackupStatus) []AppBackup
 				row.Tier2LastRun = cd.LastRun
 				row.Tier2LastStatus = cd.LastStatus
 				row.Tier2LastError = cd.LastError
+				row.Tier2LastWarning = cd.LastWarning
 				row.Tier2SizeHuman = cd.LastSizeHuman
 				switch cd.LastStatus {
 				case "ok":

controller/internal/web/templates/backups_apps.html

@@ -219,6 +219,7 @@
                         </span>
                         {{end}}
                         {{if .Tier2SizeHuman}}<span class="tier-size">{{.Tier2SizeHuman}}</span>{{end}}
+                        {{if .Tier2LastWarning}}<span class="layer-reason" style="color:var(--warn);opacity:.9">{{.Tier2LastWarning}}</span>{{end}}
                         <span class="tier-contents">{{.BackupContents}}</span>
                         <span class="tier-browsable" title="A mentés böngészhető fájlrendszerben"><svg class="ico ico-sm"><use href="#i-file-text"/></svg></span>
                         <div class="layer-actions">